Head, Cyber Security

About the role

The Head, Cyber Security is responsible for providing strategic leadership, governance, and oversight of the Group's cybersecurity posture across hospitals, clinical environments, and digital platforms. This role will lead cybersecurity strategy, operations, risk management, compliance, and security transformation initiatives while safeguarding patient data and critical healthcare systems.

Key responsibilities

Strategic Leadership & Governance

• Define, lead, and execute the Group-wide cybersecurity strategy and multi-year roadmap aligned with business objectives.
• Establish and maintain the Group's cybersecurity risk appetite, ensuring alignment with enterprise risk management.
• Provide regular cyber risk reporting and advisory to KPJ Management, CDO, and Board-level stakeholders.
• Develop and enforce cybersecurity policies, standards, and governance frameworks across all entities.

Cybersecurity Operations & Resilience

• Oversee end-to-end cybersecurity operations including SOC, threat intelligence, vulnerability management, and incident response.
• Lead major cybersecurity incidents and crisis management, ensuring effective response, communication, and recovery.
• Ensure continuous improvement of detection, response, and recovery capabilities across hospitals.

Regulatory Compliance & Risk Management

• Ensure compliance with healthcare regulations, data protection laws (e.g. PDPA), and relevant cybersecurity standards.
• Drive risk assessments across clinical systems, infrastructure, and third-party environments.
• Lead internal and external audits related to cybersecurity and ensure timely remediation of findings.

Digital Transformation & Security Engineering

• Champion security-by-design principles across all digital initiatives, including HIS, cloud platforms, and AI/analytics use cases.
• Partner with technology and business teams to embed cybersecurity into system architecture and project lifecycles.
• Ensure secure adoption of emerging technologies while balancing innovation and risk.

Third-Party & Vendor Management

• Own and manage key cybersecurity vendor relationships, including managed SOC, security tooling, and consulting partners.
• Establish and enforce third-party security risk management practices across the Group.

Financial & Organizational Management

• Manage cybersecurity budget, ensuring optimal allocation of resources and cost-effective investments.
• Drive capability development, awareness, and a strong security culture across the organization.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (Master's preferred but not mandatory).

• Professional certifications such as CISSP, CISM, CRISC, or equivalent are highly advantageous.

• Minimum 10-15 years of experience in cybersecurity, with at least 5 years in a leadership role.

• Proven track record in developing and implementing enterprise cybersecurity strategies.

• Strong understanding of healthcare IT environments, including clinical systems (HIS), medical devices, and data privacy requirements.

• Experience managing SOC operations, incident response, and cyber crisis management.

• Familiarity with regulatory frameworks such as PDPA, ISO 27001, NIST, and healthcare-specific requirements.

Skills & Competencies

• Strong leadership and stakeholder management skills, with the ability to influence at executive and board levels.
• Strategic thinking with the ability to translate risk into business impact.
• Excellent communication skills, particularly in articulating cybersecurity risks to non-technical stakeholders.
• Decision-making under pressure, especially during incidents or crises.
• Vendor and contract management expertise.